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PRRT JMINARY AMENDMENT 



Commissioner for Patents 
Washington, DC 20231 

Dear Sir: 

Prior to substantive Examination of the above-identified patent application, please 
enter the following amendments. 

IN THE TITLE: 

Please delete the TITLE OF THE INVENTION, and insert a new TITLE OF THE 
INVENTION as set forth hereinbelow: 

-- SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR POLICY- 
BASED BILLING IN A NETWORK ARCHITECTURE -. 

IN THE SUMMARY: 
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Please delete the SUMMARY OF THE INVENTION, and insert a new 
SUMMARY OF THE INVENTION as set forth hereinbelow: (See Appendix A) 

A system, method and computer program product are provided for policy-based 
billing for a network session. Initially, a plurality of packets is received by a plurality of 
analyzers. Thereafter, the packets are aggregated. Next, the plurality of packets is 
analyzed to identify a plurality of flows and an session associated with the flows. At least 
one application associated with the session is also identified. The session is then 
reconstructed utilizing the identified application. A user associated with the session is 
then identified along with a policy. The user is then billed for the session in accordance 
with the policy. 

IN THE ABSTRACT: 

Please delete the ABSTRACT OF THE INVENTION, and insert a new 
ABSTRACT OF THE INVENTION as set forth hereinbelow: (See Appendix B) 

A system, method and computer program product are provided for policy-based 
billing for a network session. Initially, a plurality of packets is received by a plurality of 
analyzers. Thereafter, the packets are aggregated. Next, the plurality of packets is 
analyzed to identify a plurality of flows and an session associated with the flows. At least 
one application associated with the session is also identified. The session is then 
reconstructed utilizing the identified application. A user associated with the session is 
then identified along with a policy. The user is then billed for the session in accordance 
with the policy. 

IN THE CLAIMS: 

Please cancel claims 1-19, and add claims 20-40, as follows: 
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20. A method for policy-based billing for a network session, comprising: 

(a) receiving a plurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 

(c) analyzing the plurality of packets to identify a plurality of flows; 

(d) identifying a session associated with the flows; 

(e) identifying at least one application associated with the session; 

(f) reconstructing the session utilizing the identified application; 

(g) identifying a user associated with the session; 

(h) determining a policy; and 

(i) billing the user for the session in accordance with the policy. 

21 . The method as recited in claim 20, and further comprising filtering the packets for 
removing packets unrelated to the session. 

22. The method as recited in claim 20, and further comprising identifying application 
events associated with the session based on the policy. 

23. The method as recited in claim 22, and further comprising assigning a significance 
to the application events based on the policy. 

24. The method as recited in claim 22, wherein the user is billed for the session 
utilizing the application events in accordance with the policy. 

25. The method as recited in claim 22, and further comprising determining billing 
information for the session using the application events in accordance with the policy. 

26. The method as recited in claim 25, and further comprising outputting a report 
including the billing information in accordance with the policy. 

27. The method as recited in claim 20, and further comprising restricting tasks of the 
user in accordance with the policy. 
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28. The method as recited in claim 27, wherein an amount of bandwidth is restricted 
in accordance with the policy. 

29. The method as recited in claim 20, wherein the policy includes a series of packet 
capture language expressions and output selectors. 

30. A computer program product for policy-based billing for a network session, 
comprising: 

(a) computer code for receiving a plurality of packets at a plurality of analyzers; 

(b) computer code for aggregating the plurality of packets; 

(c) computer code for analyzing the plurality of packets to identify a plurality of 
flows; 

(d) computer code for identifying a session associated with the flows; 

(e) computer code for identifying at least one application associated with the session; 

(f) computer code for reconstructing the session utilizing the identified application; 

(g) computer code for identifying a user associated with the session; 

(h) computer code for determining a policy; and 

(i) computer code for billing the user for the session in accordance with the policy. 

3 1 . The computer program product as recited in claim 30, and further comprising 
computer code for filtering the packets for removing packets unrelated to the session. 

32. The computer program product as recited in claim 30, and further comprising 
computer code for identifying application events associated with the session based on the 
policy. 

33. The computer program product as recited in claim 32, and further comprising 
computer code for assigning a significance to the application events based on the policy. 
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34. The computer program product as recited in claim 32, wherein the user is billed 
for the session utilizing the application events in accordance with the policy. 

35. The computer program product as recited in claim 32, and further comprising 
computer code for determining billing information for the session using the application 
events in accordance with the policy. 

36. The computer program product as recited in claim 35, and further comprising 
computer code for outputting a report including the billing information in accordance 
with the policy. 

37. The computer program product as recited in claim 30, and further comprising 
computer code for restricting tasks of the user in accordance with the policy. 

38. The computer program product as recited in claim 37, wherein an amount of 
bandwidth is restricted in accordance with the policy. 



39. The computer program product as recited in claim 30, wherein the policy includes 
a series of packet capture language expressions and output selectors. 



40. 


A method for policy-based billing for a network session, comprising: 


(a) 


receiving a plurality of packets at a plurality of analyzers; 


(b) 


aggregating the plurality of packets; 


(c) 


analyzing the plurality of packets to identify at least a first flow; 


(d) 


identifying a session associated with the first flow; 


(e) 


identifying additional flows in the plurality of packets associated with the session; 


(f) 


filtering the packets for removing packets unrelated to the session; 


(g) 


identifying at least one application associated with the session; 


(h) 


reconstructing the session utilizing the identified application; 


(i) 


identifying a user associated with the session; 


0") 


identifying a policy; 
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(k) gathering application events associated with the session based on the policy; 

(1) assigning a significance to the application events based on the policy; 

(m) determining billing information for the session using the application events in 

accordance with the policy; 
(n) outputting a report including the billing information in accordance with the policy; 
(o) restricting tasks of the user in accordance with the policy; and 
(p) executing actions in response to the application events in accordance with the 

policy. 



REMARKS 

The claims of the present application have been amended to include subject matter 
clearly disclosed in the originally filed specification. No new matter has been added. 

In the event a telephone conversation would expedite the prosecution of this 
application the Examiner may reaclrthe undersigned at (408) 505-5 100. The 
Commissioner is hereby authorized to charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1351 (Order No. XACTP015B). 



P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 
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